Data Processing Agreement

Last updated: June 21, 2026

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between the customer (“Controller”) and the operator of HoundShield (an independent sole proprietor) (“Processor”), and governs the processing of Personal Data and Covered Defense Information. It is offered to satisfy GDPR Art. 28, the HIPAA Business Associate requirements, and DFARS 252.204-7012 flow-down obligations. For a countersigned copy, email legal@houndshield.com.

HoundShield is operated by an independent sole proprietor. A registered legal entity and postal address will be published here before general availability. For any privacy, data-protection or legal request in the meantime, contact legal@houndshield.com — requests are answered within the statutory time limits regardless of entity status.

1. Roles & Scope

The Controller determines the purposes and means of processing. The Processor processes data only on documented instructions from the Controller and solely to provide the HoundShield service. This DPA applies to all Personal Data, Controlled Unclassified Information (CUI), and Protected Health Information (PHI) processed on the Controller’s behalf.

2. The Local-Only Boundary

HoundShield’s scanning engine runs inside the Controller’s own network. Prompt content, CUI, PHI, and PII are inspected on-premise and never transmitted to HoundShield’s servers. The Processor receives only metadata — prompt hashes, risk classifications, detected entity types, and timestamps — which contains no raw sensitive content. This architecture means the largest category of regulated data is structurally outside the scope of any sub-processing relationship.

3. Sub-processors

The Processor engages the following sub-processors for the cloud control plane (account, billing, metadata):

  • Vercel — Application hosting, edge delivery and build pipeline (United States)
  • Supabase — Authentication, Postgres database and session storage (United States)
  • Stripe — Payment processing and checkout for the assessment report (United States)
  • Resend — Transactional email — receipts, password reset, notifications (United States)
  • PostHog — Product analytics. Loaded only after cookie consent is granted. (United States)
  • Sentry — Error monitoring and stack traces (United States)
  • Cloudflare — Turnstile CAPTCHA on authentication endpoints (Global edge)
  • OpenRouter — Routes Brain AI questions to commercial LLM providers. NOT FedRAMP-authorized and NOT covered by a BAA — never submit CUI or PHI to Brain AI. (United States)
  • Bytez — Model inference endpoint referenced by the application CSP (United States)
  • Amazon CloudFront — Media delivery for site video assets (Global edge)

This is the same list published on the sub-processors page and cited by the Privacy Policy, rendered from one source so the three documents cannot disagree.

The Processor will give 30 days’ notice of any new sub-processor and the Controller may object on reasonable data-protection grounds.

4. Security Measures

  • AES-256 encryption for any quarantined content at rest
  • TLS 1.3 for all data in transit
  • SHA-256 append-only cryptographic audit trail
  • Row-Level Security (RLS) isolating each tenant’s metadata
  • Principle of least privilege for all internal access

See the full Security & Trust page.

5. Data Subject Rights & Assistance

The Processor will assist the Controller in responding to data-subject requests (access, correction, deletion, portability) and in meeting breach-notification obligations. Because content stays local, most data-subject requests can be fulfilled by the Controller without involving the Processor.

6. Breach Notification

The Processor will notify the Controller without undue delay, and in any case within 72 hours, after becoming aware of a Personal Data breach affecting the control plane, including the nature of the breach and the measures taken to mitigate it.

7. Return & Deletion

On termination, the Processor will delete or return all Controller metadata within 30 days, except where retention is required by law. Local prompt content is already under the Controller’s sole custody and is unaffected.

8. International Transfers

Where EU/UK Personal Data is processed, the parties incorporate the EU Standard Contractual Clauses (2021/914) and the UK International Data Transfer Addendum by reference.

9. Contact

Data-protection inquiries: legal@houndshield.com.

Privacy Policy →Terms of Service →Security & Trust →